CVE-2020-12137

MEDIUM

GNU Mailman 2.0-2.1.29 - Cross-Site Scripting via Scrubbed MIME Part

Title source: llm
STIX 2.1

Description

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

References (11)

Core 11
Core References
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/02/24/2
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/02/24/3
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/04/24/3
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4664
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4348-1/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html

Scores

CVSS v3 6.1
EPSS 0.0522
EPSS Percentile 90.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (10)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 8.0
fedoraproject/fedora 31
fedoraproject/fedora 32
gnu/mailman 2.0 - 2.1.30
opensuse/backports_sle 15.0 sp2
opensuse/leap 15.2
Published Apr 24, 2020
Tracked Since Feb 18, 2026